Segregation of Duties Explained: Authorisation, Custody and Recording
By SimplyCPA · 24 October 2026
On this page (8)
- Core rule: Keep authorisation, custody of assets and record-keeping with different people.
- Why: So one person can't both commit and conceal an error or fraud.
- Reconciliation: Ideally a fourth person compares records with actual assets.
- IT: Separate developers from production, and system administrators from users who process transactions.
- Small entities: Where separation isn't possible, use compensating controls such as owner review — and remember collusion and management override can defeat any segregation.
The idea
If one person can approve a payment, make it and record it, they can also hide a mistake — or a theft. Segregation of duties splits the steps of a transaction between people so that each one's work acts as a check on the others. It's one of the most tested internal control concepts in AUD and ISC, and it falls within COSO's control activities component.
The three duties to keep apart
- Authorisation — approving transactions (approving a purchase order, a credit limit or a pay rise).
- Custody — handling the assets (cash, inventory, cheque signing, access to the warehouse).
- Recording — keeping the books (posting journal entries, maintaining the ledger).
A fourth function, reconciliation — comparing the records with the actual assets, such as a bank reconciliation or an inventory count — is strongest when done by someone independent of all three.
Classic incompatible pairs
| Combined duties | What could go wrong |
|---|---|
| Receiving customer cash + posting to customer accounts | Lapping: stealing one customer's payment and covering it with the next |
| Approving vendors + approving payments | Paying a fictitious vendor set up by the same person |
| Payroll preparation + distributing pay | Paying "ghost" employees |
| Custody of inventory + recording inventory | Theft concealed by adjusting the records |
In IT systems
- Programmers shouldn't be able to move their own changes into the live (production) system.
- System and security administrators shouldn't process business transactions.
- User access should follow the least privilege principle, with role-based access reviewed regularly.
These are part of IT general controls — see our ISC IT general controls notes.
When a company is too small
A business with two people in the office can't fully separate duties. It relies on compensating controls instead — for example, the owner reviewing bank statements and approving all payments, mandatory holidays, job rotation, or independent reviews.
The limits
- Collusion — two or more people working together can defeat segregation.
- Management override — senior managers may be able to bypass controls altogether, which is why auditors always treat it as a fraud risk.
Practice MCQ
Which combination of duties is most likely to allow an employee to steal cash and conceal it?
(A) Opening the mail and preparing the remittance list (B) Receiving customer payments and recording them in the accounts receivable ledger (C) Approving purchase orders and receiving goods (D) Preparing the bank reconciliation and reviewing payroll
Answer: B. Custody plus recording lets the employee take the cash and hide it in the customer accounts.
Read more in our COSO framework explainer and the AUD internal control notes.